CVE-2026-41255

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-41255", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-18T14:01:46.800Z", "datePublished": "2026-05-13T18:57:41.256Z", "dateUpdated": "2026-05-14T12:44:14.133Z"}, "containers": {"cna": {"title": "CKAN: CSRF exemption primed by anonymous requests", "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "lang": "en", "description": "CWE-352: Cross-Site Request Forgery (CSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/ckan/ckan/security/advisories/GHSA-mcvf-jxcw-vj73", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ckan/ckan/security/advisories/GHSA-mcvf-jxcw-vj73"}, {"name": "https://github.com/Shirshaw64p/security-advisories/tree/main/CVE-2026-41255", "tags": ["x_refsource_MISC"], "url": "https://github.com/Shirshaw64p/security-advisories/tree/main/CVE-2026-41255"}], "affected": [{"vendor": "ckan", "product": "ckan", "versions": [{"version": ">= 2.11.0, < 2.11.5", "status": "affected"}, {"version": "< 2.10.10", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-13T18:57:41.256Z"}, "descriptions": [{"lang": "en", "value": "CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, Access to the views via tokens or unauthenticated requests marked the endpoint as not requiring CSRF protection. The marking was a member variable in flask-wtf.csrf.CSRFProtect(), which was stored as a module level variable in the flask_app middleware. This API was never intended for request level changes, it is primarily a decorator for static configuration. An unauthenticated request could hit a protected endpoint, exempting it from CSRF protection for the life of the particular server process. (e.g. one worker of uwsgi). This vulnerability is fixed in 2.10.10 and 2.11.5."}], "source": {"advisory": "GHSA-mcvf-jxcw-vj73", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/ckan/ckan/security/advisories/GHSA-mcvf-jxcw-vj73", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-14T12:44:10.283785Z", "id": "CVE-2026-41255", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-14T12:44:14.133Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "CKAN: CSRF exemption primed by anonymous requests", "source": {"advisory": "GHSA-mcvf-jxcw-vj73", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "ckan", "product": "ckan", "versions": [{"status": "affected", "version": ">= 2.11.0, < 2.11.5"}, {"status": "affected", "version": "< 2.10.10"}]}], "references": [{"url": "https://github.com/ckan/ckan/security/advisories/GHSA-mcvf-jxcw-vj73", "name": "https://github.com/ckan/ckan/security/advisories/GHSA-mcvf-jxcw-vj73", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Shirshaw64p/security-advisories/tree/main/CVE-2026-41255", "name": "https://github.com/Shirshaw64p/security-advisories/tree/main/CVE-2026-41255", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, Access to the views via tokens or unauthenticated requests marked the endpoint as not requiring CSRF protection. The marking was a member variable in flask-wtf.csrf.CSRFProtect(), which was stored as a module level variable in the flask_app middleware. This API was never intended for request level changes, it is primarily a decorator for static configuration. An unauthenticated request could hit a protected endpoint, exempting it from CSRF protection for the life of the particular server process. (e.g. one worker of uwsgi). This vulnerability is fixed in 2.10.10 and 2.11.5."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352: Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-13T18:57:41.256Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-41255", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-14T12:44:10.283785Z"}}}], "references": [{"url": "https://github.com/ckan/ckan/security/advisories/GHSA-mcvf-jxcw-vj73", "tags": ["exploit"]}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-05-14T12:44:02.090Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-41255", "state": "PUBLISHED", "dateUpdated": "2026-05-13T18:57:41.256Z", "dateReserved": "2026-04-18T14:01:46.800Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-13T18:57:41.256Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "ckan", "vendor": "ckan", "versions": [{"status": "affected", "version": ">= 2.11.0, < 2.11.5"}, {"status": "affected", "version": "< 2.10.10"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:okfn:ckan:*:*:*:*:*:*:*:*", "matchCriteriaId": "67854247-8130-4ED6-BFC0-3221AD5B7E7C", "versionEndExcluding": "2.10.10", "vulnerable": true}, {"criteria": "cpe:2.3:a:okfn:ckan:*:*:*:*:*:*:*:*", "matchCriteriaId": "A7DF9D70-4F27-4966-A66C-9E8147579BCA", "versionEndExcluding": "2.11.5", "versionStartIncluding": "2.11.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, Access to the views via tokens or unauthenticated requests marked the endpoint as not requiring CSRF protection. The marking was a member variable in flask-wtf.csrf.CSRFProtect(), which was stored as a module level variable in the flask_app middleware. This API was never intended for request level changes, it is primarily a decorator for static configuration. An unauthenticated request could hit a protected endpoint, exempting it from CSRF protection for the life of the particular server process. (e.g. one worker of uwsgi). This vulnerability is fixed in 2.10.10 and 2.11.5."}, {"lang": "es", "value": "CKAN es un DMS (sistema de gesti\u00f3n de datos) de c\u00f3digo abierto para impulsar centros de datos y portales de datos. Antes de 2.10.10 y 2.11.5, el acceso a las vistas a trav\u00e9s de tokens o solicitudes no autenticadas marcaba el endpoint como que no requer\u00eda protecci\u00f3n CSRF. El marcado era una variable miembro en flask-wtf.csrf.CSRFProtect(), que se almacenaba como una variable a nivel de m\u00f3dulo en el middleware flask_app. Esta API nunca fue dise\u00f1ada para cambios a nivel de solicitud, es principalmente un decorador para configuraci\u00f3n est\u00e1tica. Una solicitud no autenticada pod\u00eda alcanzar un endpoint protegido, eximi\u00e9ndolo de la protecci\u00f3n CSRF durante la vida del proceso particular del servidor. (ej. un worker de uwsgi). Esta vulnerabilidad est\u00e1 corregida en 2.10.10 y 2.11.5."}], "id": "CVE-2026-41255", "lastModified": "2026-11-11T20:10:00.273", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41255", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-14T12:44:10.283785Z", "version": "2.0.3"}}]}, "published": "2026-05-13T19:17:22.127", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/Shirshaw64p/security-advisories/tree/main/CVE-2026-41255"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/ckan/ckan/security/advisories/GHSA-mcvf-jxcw-vj73"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Vendor Advisory"], "url": "https://github.com/ckan/ckan/security/advisories/GHSA-mcvf-jxcw-vj73"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.11.0,2.11.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.10.10)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "ckan", "source": "cna", "vendor": "ckan"}, "product": "ckan", "vendor": "ckan"}], "created": "2026-05-13T20:30:03.839483+00:00", "updated": "2026-05-13T20:30:04.256963+00:00", "vendors": ["ckan", "ckan$PRODUCT$ckan"]}